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13A, 14, 14A, 17, 17A, and 18. A clean copy of the amended 
pages is also attached hereto. 

IN THE DRAWINGS: 

Amend FIGS. 1 through 5 and 7 through 16 as shown in 
red in the attached sketches. 

IN THE CLAIMS: / / 



By the present Preliminary Amendment, the 
specification has been amended to conform it with U.S. 
practice. Further, FIGS. 1 through 5 and 7 through 16 have 
been amended to provide English translations for the 
elements designated in French. Still further, former 
claims 1-12 have been replaced by new claims 13 - 28 for 
reasons other than having to do with patentability issues, 
namely to more completely set forth the invention and to 
put the claims into U.S. style format. 

An early action on the merits is respectfully 
solicited. 




Cancel claims 1-12 without prejudice and replace 



them with the attached new claims 13-28 




REMARKS 




Should the Examiner believe an additional amendment is 
needed to place the case in condition for allowance, he/she 
is invited to contact the undersigned attorney at the 
telephone number listed below. 

No fee is believed to be due as a result of this 
Preliminary Amendment. Should the Commissioner determine 
that a fee is due, he is hereby authorized to charge said 
fee to Deposit Account No. 02-0184. 



Respectfully submitted, 




Attorney for Applicants 



Area Code 
Telephone 
Telefax 



203 

777-6628 ext. 114 
865-0297 



Date: August 24, 2001 



f Hereby certify that this correspondence is being 
$*eosited with the United States Postal Service as 
Express Mail in an envelope addressed to: Commissioner 
of Patents and Trademarks, Washington. DC 20231 



August 24, 2001 



(Date of Deposit) 




Nicole Motzer 



Date of Signature 
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SYSTEM AND METHOD FOR MEASURING THE TRANSFER 



DURATIONS AND LOSS RATES IN HIGH VOLUME 



TELECOMMUNICATION NETWORKS 



BACKGROUND OF THE INVENTION 



The present invention relates to a non-intrusive 
method for measuring the loss rates and transfer durations 
for data in a telecommunication network in packet mode. 

The invention is particularly adapted to high volume 
networks that are operated in non-connected mode. It 
relates also to a distributed architecture system 
comprising a plurality of flow observation probes arranged 
in several points in the network, and means for 
transmitting these measurements to a collecting module 
which is connected to storage means and means for analyzing 
the measurements that have been provided. 

Packet mode telecommunication networks are 
characterized in that transmitted information are conveyed 
in groups referred to as packets, that are substantially 
made up of one header which contains information for 
sending a packet through the network as well as data to be 
transmitted. Such packets are conveyed through the 
network, and travel, in accordance to what suits the best 
the latter, through the most diversified transmitting and 
switching means. 

An exemplary packet mode network is the Internet 
network which is operated with IP protocol (Internet 
Protocol) . As a few examples of transmitting and switching 
means related to the IP protocol, ISDN (integrated services 
digital network), FR (Frame Relay), ATM (Asynchronous 
Transfer Mode) , SDH (Synchronous Digital Hierarchy) , SONET 
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(Synchronous Optical network) , DWDM (Dense Wavelength 
Digital Multiplexing) networks, etc., can be found. 
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close with one another. 

The present invention aims to alleviate the above- 
mentioned drawbacks. 



SUMMARY OF THE INVENTION 
To this end, one object of the invention is to provide 
a method and a system with a distributed architecture that 
allow to measure accurately the transfer durations and loss 
rates for telecommunication networks in packet mode. The 
method comprises the steps for performing the measurement 
operations by a plurality of observing probes that are 
synchronized and distributed at different points in the 
network, on data packets which are transmitted through the 
network, the measurement operations comprising the dating 
and the identification of the data packets, the measurement 
results being transmitted from the probes to the collecting 
module . 

The method according to the invention is characterized 
in that the measurement operations further comprise a 
classification of the data packets in a homogenous flow, 
and a counting of the packets in the flow, the measurement 
results being transmitted from the probes to the collecting 
module through the network (1), the collecting module 
performing a correlation between all of the measurement 
results received from the probes, including the 
determination of the unidirectional transfer durations per 
flow or information flow group, and of the loss rate for 
the packets. 

The method according to the invention is advantageous 
in that it does not require the use of test packets, which 
permits the achievement of a very wide representativeness 
of every measurement. It is also advantageous in that a 
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large number of measurements can be carried out, resulting 
in a high degree of statistical accuracy. Finally, the 
number of measurements being carried out can be modulated 
in 
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in one flow, the transmitting means of the probes using the 
network to transmit the measurements carried out to the 
collecting module, the collecting module comprising means 
for determining the unidirectional transfer durations per 
flow or information flow group and the loss rate for the 
packets . 



BRIEF DESCRIPTION OF THE DRAWINGS 

Other characteristics and advantages of the invention 
will be more fully understood from the following 
description to be considered as a non-limitative example 
while referring to the appended drawings, in which: 

[-] Figure 1 shows schematically an exemplary 
embodiment of the invention in a telecommunication network 
in packet mode; 

[-] Figure 2 shows a functional diagram of a system 
implementing a method according to the invention; 

[-] Figure 3 depicts schematically an example of an 
internal function organization for a system according to 
the invention; 

[-] Figure 4 shows a functional diagram depicting the 
operation of an observing probe used in a system according 
to the invention; 

[-] Figure 5 shows a functional diagram depicting the 
operation of a collecting module used in a system according 
to the invention; and 

[-] Figure 6 to 15 depict schematically the operation 
of a system according to the invention. 



DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT (S) 
In Fig. 1, there is shown schematically a high volume 
network 1 that is operated in non-connected mode, such as a 
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network based on IP protocol (Internet Protocol) . A 
plurality of flow-observing probes 2± are arranged at 
different points in the network for carrying out 
measurements on flows of data that are exchanged through 
this network. Means for compressing 
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each packet they have access to. These measurements 
consist in performing dating, classification and 
identification of the packets, as well as compressing these 
measurements. Every probe 2 L transmits, through the network 
1, the compressed measurements to the collecting module 4 
that correlates all of these measurements. 

Other embodiments are also possible in the scope of 
the invention, notably in the following cases: 

- the users 8± are not necessarily end users for information 
being conveyed within the packets; for instance, they may 
represent local networks or other networks in packet mode; 

- the probes [2i] 2i can be connected to the collecting 
module 4 through means other than the network 1; for 
instance, through another telecommunication network, or 
through a local storage medium that stores data from the 
collecting module 4, sending them back to it later on; 

- the same collecting module 4 can be connected to several 
collecting modules 4; 

- several collecting modules 4 can communicate to build up 
correlations between measurement elements they have. 

As an example, a possible functional diagram of the 
system according to the invention is shown in Fig. 3. Four 
functional groups can be found therein: 

- the rule group 10, with the rules being fixed statically 
or semi-statically (for example by the system operator); 

- the load evaluation group 20, measuring the load rate on 
the local central processing unit, the memory occupancy, 
etc. • • / 

- the calculation group 30, evaluating dynamically the 
values relating to compaction, sampling, etc...; 
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- the data path group 40, producing records that contain 
. combinations (class, date, signature) for each packet* 

When activated, the probes 2i gain a common time 
reference 31. The inaccuracy of this reference between two 
probes 2i affects directly the accuracy of the result for 
the whole device. Means for gaining that time reference 
can be diversified as well as multiple; as non-limitative 
examples, GPS (Global Positioning System) , broadcasting 
through radio waves, high stability drivers, NTP (Network 
Time Protocol) and SNTP (Simple Network Time Protocol) 
protocols may be mentioned; 

- each packet is subjected to dating 41 using the absolute 
time reference when it is observed by a probe [2i] 2i. 
The latter is able to date, either the start of the 
packet, or the end of the packet, or any other criterion. 

- each packet is subjected to the calculation of the 
signature 42, that is for representing it later on. The 
signature enables to reduce the amount of information 
which is needed to identify the packet. That signature 
results typically from a binary polynomial calculation 
(for instance, CRC calculation - cyclic redundancy check - 
on 16 or 32 bit elements) . The signature calculation is 
performed either on the whole packet or on a part of it, 
in accordance to what is contemplated in relation with the 
structure and the variability of the contents of the 
packets in the network. The signature has to be small 
compared to the mean pocket size, so as to ease its 
storage, its transmission and its subsequent processing. 
It must be capable of assuming different values to make 
negligible the likelihood that two different packets have 
the same signature. As an example, it 
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can be considered that one signature on 16 bit elements 
enables to identify about 256 different packets with a low 
likelihood of ambiguity; 

- each packet is subjected to a classification operation 44. 
Criteria for classification are typically those that are 
conventionally retained to identify flows between networks 
and sub-networks (such as IP network sub-addresses), flows 
between end equipment (such as IP addresses), flows 
between applications (such as IP addresses and UDP/TCP 
transport addresses), etc... Each packet is then 
identified by combining all or part of the elements : 
class, date, signature; 

- each class can be subjected to filtering 45; i.e., the 
probes [2i] 2i do not store the combinations (class, date, 
signature) for packets belonging to one of the classes for 
which the filter has been provided; 

- each class can be subjected to a compaction or a semi- 
static sampling operation 46. In this case, only a part 
of the combinations (class, date, signature) for packets 
belonging to a given class will be retained. The sampling 
rate depends typically of the class, and will not 
theoretically change dynamically. For instance, it may be 
desirable to keep all of the combinations of packets 
conveying voice, and only a part of those conveying 
computer files . 

- each class can be subjected to a dynamic sampling with a 
rate which depends of the congestion conditions in the 
system : measurement of the occupancy of buffers 21 and 
memories 22 of the probes [2i] 2±, transmission flow rates 
towards the collecting module 4, network load, load of the 
collecting module 4, etc... A multiplicity of criteria 
can be used so that the overall operation 
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can take place automatically in an area that suits the 
best the device administrator. For instance, the highest 
sampling rate for a given maximum flow rate of a flow 
brought back from the probe to the collector, or a minimum 
flow rate of a flow brought back to the collector for a 
given sampling rate; 
- a counter is associated with each combination (class, 
date, signature) that is retained, indicating the number 
of packets observed in the flow. The collecting module 4 
is then capable to measure the loss rate in the network by 
comparing between the counters associated with the same 
packets at different points in the network. 

The filtering and static and dynamic sampling 
operations allow to reduce the amount of combinations 
(class, date, signature) to be stored [et] and processed. 
The provision or removal of filters, the values of the 
semi-static sampling rates, the parameterization the 
dynamic sampling, etc..., can be achieved, for instance, 
through an administrative operation performed from one of 
the collecting modules 4 or operating modules 7. 

Sampling criteria can be diversified. As examples, 
periodical sampling which consists in keeping one 
combination every N combinations, statistical sampling that 
depends on drawing a random variable of which statistical 
characteristics are under control, and sampling on 
signature that consists in keeping only those combinations 
of which the signatures belong to a given set of values can 
be mentioned. 

The sequence order through which a probe 2 X performs 
the above-mentioned operations may change. A probe 2 ± can 
classify the packets before dating them, as long as the 
measurement accuracy is not altered to a great extent. In 
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the same way, the filtering operations can be performed at 
different instants during the process. 
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Fig. 5 depicts the steps for collecting and 
correlating the measurements by a collecting module 4. 

The latter receives samples of the non-filtered 
combinations (class, date, signature) originating from all 
of the observing probes 2i attached therewith; 

- each packet is theoretically seen by two observing probes 
[2i] 2i : the first time when entering the network, the 
second time when leaving. However, other situations may 
occur. For instance, one packet might be seen only once 
if the supervision domain is not closed, or more than 
twice if there are observing probes [2i] 2i within the 
network; 

- each time a packet has been observed by an observing probe 
[2i] 2i as passing by, one combination (class, date, 
signature) is received by the collecting module 4, except 
when filtering, sampling or loss of return message, 
etc..., is taking place; 

- the collecting module 4 correlates the combinations 
(class, date, signature) for the same packet, for instance 
by comparing between the signatures and by increasing the 
transit delays in the network; 

- in case of success, it infers from above, through a simple 
arithmetical calculation, on one hand, the transfer 
duration between the different observing probes [2i] 2i 
for the packet in question and on the other hand, the 
number of packets that were possibly lost in the network. 
Moreover, a number of packets in excess at the exit 
enables to indicate that a fault in one of the network 
devices or an intrusion attempt has occurred. More 
sophisticated calculations, such as mean, minimum, 
maximum, median, etc..., values for a given time slot and 
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a certain flow type, can also be achieved in the 
collecting module 4 prior to the storage operation 
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It is to be noted that sampling do not reduce the 
counting accuracy. This is equally true when packets are 
lost, that otherwise would have cause tickets to be issued. 
Actually, the counter that is associated with every ticket 
produced yields the total number of packets since the last 
sampled ticket. The only consequence is a loss of accuracy 
as for the precise instant at which the loss occurred and 
the exact identity of the packet that was lost. Both 
characteristics are of little usefulness a priori, thus 
being not much looked after. However, as the sampling 
characteristics are attached to a certain flow, it is 
always possible not to sample the flows for which detailed 
information are desirable. For those flows, all of the 
packets will cause one ticket to be issued. Moreover, as 
the number of measurements is lower than the number of 
packets, statistical laws will be applicable, that are well 
known as for the validity and the accuracy of the 
measurements which are applied to the sample thus captured. 

Therefore, the method according to the invention 
enables to achieve flow control at the probe level in 
order: 

- to protect the collecting module 4 against an overload : 
(too many tickets to be processed relatively to its own 
resources that are the available processing power and the 
memory size, . . . ) ; 

- to protect the probes [2i] 2i against an overload : (too 
many tickets to be processed relatively to its own 
resources that are the available processing power and the 
memory size, . . . ) ; 

- to protect the network used to transmit ticket records 
from the probe to the collector; 
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- to adapt to changes in the capacity of the network used to 
transmit ticket records from the probes [2i] 2i to the 
collecting module 4; 
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- to enable an optimum distribution of the measurement 
resource between the different flows in case of 
congestion; 

- to optimize the pair (measurement accuracy/network load) 
in accordance with combined criteria, in normal operation. 

To control the flow, the following functions may by 
used, separately or in combination: 

- limitation of the overall flow through the network to a 
maximum value due to the transmission of ticket records 
from the probes [2i] 2i to the collecting module 4. That 
limit can, either be defined by an initial configuration, 
or be modulated by the collecting module 4 or by an 
external device operating the network; 

- limitation of the sampling rate to a maximum value. That 
limit can, either be defined by an initial configuration, 
or be provided by the collecting module 4 or by an 
external device operating the network. In addition, it 
may differ from each type of flow or flow group; 

- reduction of the sampling rate. That reduction can, 
either be defined locally by observing the congestion of 
the probes [2i] 2i, or be fixed by the collecting module 4 
or by an external device operating the network. That 
reduction may differ for each type of flow or flow group. 
The reduction law must allow the collection module 4 to 
correlate records which were performed by probes 2i 2i 
having not the same sampling value for a given flow, the 
reduction being not necessarily synchronous between the 
probes [2i] 2i. A principle which must be retained is the 
inclusion one; tickets of the "reduced" flows having to be 
included also in the tickets of the "lesser reduced" 
flows. In this way, tickets of the probe 2± having the 
highest reduction factor 



